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The MAILING DATE of this communication appears on the cover sheet with the correspondence address 



Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

Responsive to communication(s) filed on 25 February 2005 . 
2a)[3 This action is FINAL 2b)D This action is non-final. 

3) Q Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-33 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) ^3 Claim(s) 1-33 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)Q Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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1) Notice of References Cited (PTO-892) 4) O Interview Summary (PTO-413) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) EJ Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 5 ) □ Notice of Informal Patent Application (PTO-152) 

Paper No(s)/Mail Date 02/05 . 6) □ Other: . 
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DETAILED ACTION 



1 . This Office Action is responding to the amendment received on February 25, 
2005. 

2. Claims 1 , 2, and 33 are amended. 

3. Claims 1-33 are pending. 



Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosesd or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

5. Claims 1-33 rejected under 35 U.S.C. 103(a) as being unpatentable over Chiu et 
al, US Patent No. 5101402, hereinafter "Chiu", in view of Dietz et al, US Patent No. 
6651099, hereinafter "Dietz". 

6. As per claims 1 and 18, Chiu discloses a method for providing a unique 
identification of monitored network data instances flowing across various connections 
between networked devices, the unique identification being derived from information 
contained entirely within each instance of the network data, the method comprising: 
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using at least one monitoring device to monitor a network data instance flowing across 
at least one data connection (Col 7 lines 15-39); deriving from the data instance certain 
information which collectively provides a unique identification (Col 9 lines 1-54) of the 
network data instance; However, Chiu does not discloses "assembling the derived 
information into an input string for a hash function; and using the output string of the 
hash function as a signature which represents a unique identifier of the network data 
instance". Nevertheless, the method of deriving the unique identifier using the hash 
function to create the signature is taught by Dietz in (Col 6 lines 18-19). Therefore, it 
would have been obvious for one having ordinary skill in the art to incorporate the hash 
function to create the signature of the unique identification data captured by the Chiu's 
invention. The result is a unique identifier signature of the session or data instance in 
the network. This signature is unique and minimal in sizing, which can be easily stored 
and processed (Col 10 lines 53-60). 

7. As per claims 2, 7-9, and 24-26, Chiu discloses the method according to Claims 
1 and 18, wherein the deriving step includes: deriving from the data instance a source 
and destination address for the data; deriving from the data instance a source and 
destination port associated with the networked devices (Col 3 lines 24-40, Col 8 lines 
54-61, and Col 9 lines 3-25) (The Transport layer header info has the ports info and The 
Link layer header info has the address info); deriving from the data instance at least one 
sequence number associated with data instance (Col 9 lines 33-45). 
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8. As per claims 3, 4, 15, 20-21, and 32, Chiu discloses the method according to 
Claims 1 and 18, which further includes: attaching the signature to at least one data 
report associated with the network data instance; and transmitting data reports and 
signatures from each monitoring device to a central collecting device (Col 12 lines 7- 
14). 

9. As per claims 5 and 22, Chiu disclose the method according to Claims 3 and 20, 
wherein the central collecting device uses the signatures to eliminate duplicate data 
reports that might come in from different monitoring devices positioned at different 
locations on the network (Col 12 lines 19-28). 



10. As per claims 6 and 23, Chiu discloses the method according to Claims 1 and 
18, wherein network data instances are data packets as part of a TCP/IP (Transmission 
Control Protocol/Internet Protocol) client-server network (Col 1 lines 13-24, and Col 2 
lines 24-39). 



11. As per claims 10 and 27, Chiu discloses the method according to Claims 9 and 
26, wherein the at least one sequence number includes both a client sequence number 
and a server sequence number (Col 9 lines 40-45, and Col 1 lines 17-24) (The 
sequence number cited is the number of packet sending back and forth by both ends). 
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12. As per claims 11 and 28, Chiu discloses the method according to Claims 2 and 
19, wherein the input string information does not include sequence numbers (Col 9 lines 
3-9). 



13. As per claims 12 and 29, Chiu discloses the method according to Claims 1 1 and 
28, wherein the network data instances are datagrams as part of a UDP/IP (User 
Datagram Protocol/Internet Protocol) network (Col 9 line 21) (The ACK is the UDP 
packet). 



14. As per claims 13 and 30, Chiu discloses the method according to Claims 1 and 
18. However, Neither Chiu or Dietz discloses "truncating the signature to include fewer 
bits than the hash function output string". Nevertheless, It would have been obvious at 
the time of the invention for one having ordinary skill in the art to reduce the output 
string to a fewer bits. This operation will obviously create a uniform unique signature for 
storage and processing purpose. 



15. As per claims 14 and 31, Chiu discloses the method according to Claims 1 and 
18, which further includes: adding flag bits to the signature which indicate the type of 
application associated with the network data instance (Col 10 line 54-57). 

16. As per claim 16, Chiu discloses the method according to Claim 1, wherein the 
monitoring device operates to directly monitor the network data (Col 7 lines 15-27). 
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17. As per claim 17, Chiu discloses the method according to Claim 1 , wherein the 
monitoring device operates to indirectly monitor the network data (Col 7 lines 15-27). 

18. As per claim 33, Chiu disclose method for providing a unique session key of 
monitored network data packets flowing across various connections between networked 
devices, the unique session key being derived from information contained entirely within 
each instance of the network data packet, the method comprising: using at least one 
monitoring device to monitor a network data packet flowing across at least one data 
connection (Col 12 lines 19-28); deriving from the data packet a source and destination 
address for the data is inherent in a TCP/IP network; deriving from the data packet a 
source and destination port associated with the networked devices is inherent in a 
TCP/IP network (Col 3 lines 24-40, Col 8 lines 54-61, and Col 9 lines 3-25) (The 
Transport layer header info has the ports info and The Link layer header info has the 
address info); deriving from the data packet at least one sequence number associated 
with data instance (Col 9 lines 33-45); attaching the unique session identifier to at least 
one data report associated with the network data packet (Col 12 lines 7-28); Chiu does 
use the hash function based on the current session key to access the session record 
which includes all the information derived above (Col 10 lines 18-23). However, "Chiu 
does not assembling the derived addresses, ports, and at least one sequence number 
information into an input string for a hash function; and using the output string of the 
hash function as the signature which represents a unique identifier of the network data 
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packet". Nevertheless, the method of deriving the unique identifier using the hash 
function to create the signature is taught by Dietz in (Col 6 lines 18-19). Therefore, it 
would have obvious for one having ordinary skill in the art to incorporate the hash 
function to create the signature of the unique identification data captured by the Chiu's 
invention. The result is a unique identifier signature of the session or data instance in 
the network. This signature is unique and minimal in sizing, which can be easily stored 
and processed (Col 10 lines 53-60). 

Response to Arguments 

1 9. Applicant's arguments filed February 25, 2005 have been fully considered but 
they are not persuasive. 

In regarding to the Applicant's argument on page 1 1 , Applicant argues that "the 
signature and the hash are functionally distinct from each other" is correct. The 
signature in Dietz and the flow key in Chiu has similar make up of the extracted 
information of the packet of the flow (in Chiu Col 9 lines 1-15, and in Dietz Col 13 lines 
20-23). The Hash method in Dietz is used to identify the signature by generating a hash 
of the signature itself, which includes a string of data to identify the uniqueness of the 
signature itself (in Dietz, Col 13 lines 30-36, and Col 6 lines 18-19). Therefore, it would 
have been obvious for one having ordinary skill in the art to incorporate the hash 
function to create the signature of the unique identification data captured by the chiu's 
invention (or similar to Dietz's signature in (Col 13 lines 20-23), as motivated by the 
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uniqueness of the output of the string data from the hash function, and reduced size, 
which can be easily stored and processed (emphasis added). Therefore, the rejection 
basis dated 10/21/2004 is maintained. 



Conclusion 

20. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

21 . THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
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shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 



Conclusion 

22. Any inquiry concerning this communication from the examiner should be directed 
to Linh Son whose telephone number is (571)-272-3856. 

23. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor Kim Y. Vu can be reached at (571)-272-3859. The fax numbers for this 
group are (703)-872-9306 (official fax). Any inquiry of general nature or relating to the 
status of this application or proceeding should be directed to the group receptionist 
whose telephone number is (571)-272-2100. 

24. Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval IPAIR.I system. Status information for 
published applications may be obtained from either Private PMR or Public PMR. Status 
information for unpublished applications is available through Private PMR only. For 
more information about the PAIR system, see http://pzr-direct.uspto.gov. Should you 
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have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). 



Linh LD Son 



Patent Examiner 




KIM VU 

SUPERVISORY PATENT EXAN"' 
TECHNOLOGY CENTER 2\ X' 



